How is the webhook secured?

Three ways. The webhook URL carries a key that is shown once and stored only as a hash; you can generate a signing secret so Typeform cryptographically signs every delivery and BytePhase verifies it; and every request is rate-limited and scoped to your shop alone. Rotating the key instantly retires the old URL.